I have asked at every company (EA, Ubisoft, Double Fine) I have worked for about their harassment protection policies for employees. NONE of them have one.

"SBMM is ruining <game>!" cries person whose livelihood depends on constantly generating new clips of themselves humiliating other players in-game.

It's more that the company that hardcodes an admin password also fails to lock down all the other things that aren't going to be accessible via the consumer-facing UI.

A lot of these kind of IoT devices will have hardocded credentials to gain access to the bootloader, firmware updater, or some mechanism to install certs or change URIs.
It's not "admin" in your case that's key, but instead the rest of the implementation decisions that go along with that attitude.